Step 1: Prepare a custom iPhone RAM disk. There are numerous How-To's out there to do this. I hex-edited the one that came with iLiberty+ and added my own shell intructions where the credits used to be. Your custom RAM disk should mount /dev/rdisk0s2 (say, /mnt) and simply delete the file /mnt/mobile/Library/Preferences/com.apple.springboard.plist. This is the config file that tells springboard "passcode: on". In one case, I had to move the entire preferences folder out of the way - this was on an iPhone that had been "permanently" disabled by several failed passcode attempts. Opened it up like a charm.

Step 2: The iPhone must be placed into recovery mode, but with a clean shutdown. You can either use the iPhone Utility Client to place the device into recovery mode, or "Slide to Power off", then force it into recovery on next boot... then boot the RAM disk using something like:
(iPHUC Recovery) #: filecopytophone Bypass_Passcode.bin(iPHUC Recovery) #: cmd setenv\ boot-args\ rd=md0\ -x\ -s\ pmd0=0x9340000.0xA00000(iPHUC Recovery) #: cmd saveenv(iPHUC Recovery) #: cmd bootx

Step 3: After your custom RAM disk blows away the springboard config, reboot the phone and the passcode will be circumvented, because SpringBoard's default is "no passcode".